6a9000f13976de3978e940a85a04d33fad1ff8e7433d59131baeb3c8872c47d1

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_7a54ce0c49315bc90bb3f1f40a49ee80_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260711-thzppaew6p
SHA256 6a9000f13976de3978e940a85a04d33fad1ff8e7433d59131baeb3c8872c47d1
MD5 7a54ce0c49315bc90bb3f1f40a49ee80
SHA1 4802c32def0797fd4dfe392e51b39bbf8dfba94d
SHA512 a3c5bfb67939b883f5b5101eb2125af039d08bb0c84e5367a4c19d5d5de566377f54d0149be3db2846d7e34bc8c49d517df1f2029dbfcdf5b98e12851c802313
SSDEEP 24576:S2oo60HPdt+1CRiY2eOBvcj3u10U7Ze5UeKszRZTmSzTdXKbJCeD8y4k38Q2jrsF:boa1taC070U7ZuTRZdTB4YU4k3853LM
TLSH
T191952215F791C2F6D4910674E251C3F298A93E7C92428C83BFDD2E7F29A0BC05A76B46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4624	4E26.tmp

Executes dropped EXE 1 IoCs

pid	Process
4624	4E26.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_7a54ce0c49315bc90bb3f1f40a49ee80_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4E26.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 4624	5044	2026-07-11_7a54ce0c49315bc90bb3f1f40a49ee80_amadey_elex_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-11_7a54ce0c49315bc90bb3f1f40a49ee80_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_7a54ce0c49315bc90bb3f1f40a49ee80_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Users\Admin\AppData\Local\Temp\4E26.tmp
  "C:\Users\Admin\AppData\Local\Temp\4E26.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-11_7a54ce0c49315bc90bb3f1f40a49ee80_amadey_elex_smoke-loader.exe FB62B760704FC034ECC053CA261E3EF17BFE485D3C3E6232E60DD3C2DC89F6DE62A8B4C44E275DDFDE662BCB078E4A0CFE868F6E4877A0E0CCED5450D1DD5E1C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E26.tmp

Path C:\Users\Admin\AppData\Local\Temp\4E26.tmp
Size 1.9MB
SHA256 9712f8d385ac0bc72339c7d5762bff023d3defcf556d583ced3c4ffbebc26a06
MD5 3ad774fbb4168b3b14905aea0294885a
SHA1 16e82f07c608ecd5a883c5bd5c43f1ce05b1a2ad
SHA512 0d0d79981afd61882142f9c59b22edcfff7d445ab163053fc3208cfa0d419856f31874091ef7584fa08a1ebc2732f32e43308d3386dfdca5c4af1dab71999f0e
SSDEEP 49152:boa1taC070UVajxj5O3wCE+vbffNpfb9yE9S:boa1taC0Lg5pcpfB19
TLSH
T19F952261FA95C1B2C0950AB4AAA2C3A6DCB93E7D43458C477FC81F6F2950FC02672B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4624-6-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/5044-0-0x0000000000400000-0x00000000005EB000-memory.dmp